Slashdot Log In
Earthstation 5 Claimed to be Malware
Posted by
michael
on Fri Oct 03, 2003 09:29 AM
from the compiled dept.
from the compiled dept.
Rob from RPI writes "You may remember the announcement about a company, or program, or both called Earthstation 5 who recently 'Declared War' on the MPAA. Well guess what? Turns out that it's got code in it that allows anyone to delete any file on your computer. I suggest that you un-install as soon as possible!"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Geocites eh? (Score:5, Informative)
Because the link is on geocities it's sure to be
Don't trust code from sources you don't know. I only provide these for the inevitable geocities
Not surprising (Score:3, Funny)
Just goes to show you can't trust anyone but the RIAA for f'air and balanced info-warfare:)
This is absolutely shocking. (Score:5, Funny)
Earthstation 5 is a GODSEND (Score:5, Funny)
Parent
I don't have to uninstall... (Score:3, Funny)
Well yeah.. (Score:5, Insightful)
Earth Station 5 - legalese (Score:5, Funny)
Tinfoil alarm! (Score:4, Insightful)
Re:Tinfoil alarm! (Score:5, Insightful)
I just get annoyed when I hear a computer attack referred to as an effective terrorist strategy. I certainly could survive if my computer didn't turn on today; no terror here, just kind of disappointment. Perhaps something like this could be called a "bummer. oh well" attack.
Parent
Re:Tinfoil alarm! (Score:3, Insightful)
Nobody really cares if you can
Oh God not again... (Score:5, Funny)
Can someone please please PLEASE write a filter that excludes threads that mention the words "Israel" or "Palestine" more than once each?
Here, guys, stop arguing. I'll make all of your arguments for you:
Pro-Palestinian guy: Israel is guilty of $ATROCITY1, $ATROCITY2, and $ATROCITY3
Pro-Israel guy: Surely you're not comparing things like $ATROCITY2 to $ATROCITY4, $ATROCITY5, and $ATROCITY6, which were committed by Palestinians
Pro-Palestinian guy: Oh come on! $ATROCITY6 wasn't nearly as bad as $ATROCITY3! Besides, they only did it because of $ATROCITY3! If Israel had never committed $ATROCITY3 then the Palestinians wouldn't have had to have committed $ATROCITY6!
Pro-Israel guy: but the Israels only committed $ATROCITY3 as a defensive measure because the Palestinians committed $ATROCITY7!
Anyways, I've now said EVERY SINGLE THING every partisan in this argument has ever said and will ever say, so you can all just STFU.
Parent
Re:Tinfoil alarm! (Score:4, Informative)
Please check your history before you post. The Palestinians did not come into existence until 16 years after the British handed over 1/3 of what the UN resolution required to form present-day Israel.
That's either amazing ignorance you've got there, or just the most blatant bit of lying I've seen on Slashdot for days. The "protectorate" of Palestine existed between the two world wars, and was effectively a colony of the British Empire. Jewish immigration increased dramatically during this period, a result of increased interest in Zionism, itself largely a result of anti-Jewish activity in Europe.
Palestine may not have been an independent nation state, but the Palestinian people had existed as a distinct race since biblical times when the Semitic tribes split along religious grounds. Remember that Jews and Palestinians are both Semitic races.
Israel was created following the even bigger influx of Jewsih refugees after the Second World War. Many of these refugees brought bitter memories of the concenration camps with them, and a willingness to use force to gain a nation state. The British were unable to control the situation, having been effectively bankrupted by the war, and eventually pulled out after increased bombings of their official buildings, etc. The result was bloodshed, as the Jewish militias ehnically cleansed large parts of Palestine. Pretty ironic considering the background to the Jewish desire for a nation state.
Chris
Parent
Good thing it wasn't email (Score:5, Interesting)
Re:Good thing it wasn't email (Score:5, Funny)
you must be new here.
Parent
Not surprising (Score:5, Funny)
they'll be more than glad... (Score:5, Interesting)
Methods known (Score:4, Interesting)
Seriously, it was good theory, but they didn't have anything earthshattering that couldn't be replicated.
I'll be watching for anything more that is discovered about motives. This seems to be the most curious and intriguing part of the story.
Battlestations... (Score:4, Insightful)
Unconfirmed, as of yet. (Score:5, Informative)
As of this writing, I haven't seen a single follow-up post.
Is it true? I don't know, Is it a hoax? I don't know that either. It has more than a few caveats about using the exploit, that's for sure.
What I do know is that that Geocities site with the exploit code will disappear bandwidth constrained faster than snot. :)
Re:Unconfirmed, as of yet. (Score:3, Informative)
A complicated world (Score:4, Funny)
Arggggghhhhh
Binary world-view is breaking down as we speak...
Earthstation 5 sounds like... (Score:5, Funny)
Indulging in paranoid speculation - tinfoil alert (Score:5, Insightful)
Let's say ES5 is an MPAA/RIAA front to discredit file sharing and harm filesharers.
Now, apparently, ES5 is in Palestine.
What better way to do "double damage" than to not only have a way to attack filesharers, but also to connect it to a location people associate with terrorism?
OK, tinfoil hat off now.
If you use a computer (Score:5, Insightful)
Dateline "Jenin, West Bank?" (Score:4, Funny)
Re:Dateline "Jenin, West Bank?" (Score:5, Funny)
So, the standard Tech Support staff?
Parent
Also look out for these P2P programs... (Score:3, Funny)
Babylon 5
The Dagobah System
Not a buffer overflow? (Score:5, Insightful)
If it is malicious it seems odd that they would make it possible for ANYONE to delete someone elses files through crafted search strings, thus significantly increasing the chance of their nefarious plans being uncovered.
If it were me, and I was secretly working for the RIAA, I'd just code in a simple client/server protocol that the RIAA could use to delete people's files, entirely seperate from the normal operation of the program itself. This would be much harder to identify as malicious code.
Sorry, but this just looks to me like a bad "failure to chroot()" bug and not the big conspiracy theory its purported to be...
Re:Not a buffer overflow? (Score:5, Insightful)
Even in assembler its not too hard to see when an operation is a bug resulting from jumping to a bit
of code when some unexpected events coincide and jumping to the same bit of code when a SPECIFIC packet arrives.
Parent
Re:Not a buffer overflow? (Score:3, Informative)
I'm curious - how can it be determined without the benefit of source code for ES5 that the exploit isn't just a horrendous oversight instead of a malicious pre-meditated function of the software?
Well, I'm curious - what more proof do you want?
The FD post made it clear that a particular function of the ES5 software ("0Ch, sub-function 07h") caused the behaviour. That's a completely separate function that seems to have the sole purpose of deleting files remotely. The likelyhood of such code ever getting
Re:Not a buffer overflow? (Score:3, Interesting)
This could have been added as an "internal" feature and forgotten about it. It could have been added by one un-professional programmer, unbeknownst to the rest of the group. It could be in there on purpose, and the team is naive enough to believe it'll never get abused. It could be in there on purpose because they want it there and they don't care about the ramifications. And finally, it could be there because they have plans to use it some day
Re:Not a buffer overflow? (Score:3, Informative)
A buffer overflow involves, guess it, overflowing a buffer. Putting a different byte in the command field of a packet -- without any changes in length -- is absolutely not a buffer overflow.
Jumping to a delete routine based on what's in that byte is not a "deliberate mistake".
As nice as it would be to do a bit of wishful thinking -- as a professional coder, I can state this behaviour was clearly intentionally added.
IT'S A TRAP! (Score:5, Interesting)
The first place I heard about E5 was on Slashdot, in a sig - I thought about trying it out, but something didn't seem quite right.
Too much flash and cash on the website, and sweeping claims that hadn't made it elsewhere turned me off.
I'm thinking it's the same 'spidey sense' that goes off when I get an email with an evil attachment.
Verify the presence of malware (Score:5, Funny)
Anagram conspiracy theory (Score:5, Funny)
They're behind the whole thing, I'm telling you.
Re:Anagram conspiracy theory (Score:5, Funny)
I also found "SEVENTH TIT OF RIAA"
We all know the RIAA is a bitch, but this just proves it...
Parent
Heres the trojan code (Score:5, Informative)
What's the big deal? (Score:3, Funny)
It could happen with any closed source software.. (Score:3, Informative)
Re:A bit tired of this argument... (Score:4, Insightful)
Parent
Finally, something I know about... (Score:3, Informative)
The security exploit is being tested by members of the p2p community and has been shown to be a viable exploit (forum link: http://www.p2pforums.com/viewtopic.php?p=20323#20
The operators of ESV have been slow to directly answer questions regarding this exploit:(http://forums2.es5.com/index.php?act=ST&
punish them... (Score:3, Funny)
$ wget -O
I was suspicious (Score:3, Insightful)
"The question then is 'why did they do it?' I'm sure they won't tell us, but here's a theory: They could be working for the RIAA, MPAA, or a similar organization. Once they have enough users on their ES5 network, they would start deleting all copyrighted files they own which their users are sharing. The users wouldn't know what hit them."
Can anyone come up with a plausible scenario where a P2P company would release software that destroys a computer, if it is not connected somehow to these groups?
Called it. (Score:4, Insightful)
-72
RIAA/MPAA "honeypot" (Score:5, Informative)
Re:BAH! THIS IS JUST FUD (Score:3, Insightful)
On the other side of that, $16-20 is unreasonable. $10 would be fair, I think. Considering the hours spent in the studio recording, AFM scale per musician per song being $50 (and that's for low grade musicians), the cost of a decent engineer, cost of using a decent studio (that's not cheap), mastering costs... Then you've got to either spend $$ on an
Re:BAH! THIS IS JUST FUD (Score:3, Informative)
For expected gold-platinum cd's, $8
Re:Now tell the bastards what you think! (Score:5, Interesting)
earthstation5.com Back-order this name
Domain EARTHSTATION5.COM
Date Registered: 2/26/2002
Date Modified: 6/13/2002
Expiry Date: 2005-2-26
DNS1: ns1.earthstationv.com
DNS2: ns2.earthstationv.com
Registrant
Earthstationv Ltd, A Palestinian Corporation
Jenin refugee camp #23
Jenin (PS)
NONE
Administrative Contact
EarthstationV Ltd., A Palestinian Corporation
Mr Domain Administrator
Jenin refugee camp #23
Jenin (PS)
NONE
067351065
67351065
ras@earthstationv.com
Technical Contact
EarthstationV Ltd., A Palestinian Corporation
Mr Domain Administrator
Jenin refugee camp #23
Jenin (PS)
NONE
067351065
67351065
ras@earthstationv.com
Registrar: NameScout.com
Parent
Re:Now tell the bastards what you think! (Score:5, Informative)
The *maintainer* of Earthstation V's domain record is fom Israel. I do not know what this signifies.
To see this, go here [ripe.net] and click on the mnt-by ("maintained by") link.
Parent
Re:Let's be logical about it (Score:4, Insightful)
Stealing a book from a library == theft.
Photocopying the same book ==copyright infringement != theft.
Burning the book == damage.
See how simple logic is when you're not trolling
Parent